1234842 - Firefox crashes while playing sound in JavaScript-Recursion (Data URI .wav)

Status: RESOLVED INACTIVE

(Core :: Audio/Video: Playback, defect, P3)

Description

[Dennis Knobloch]

Attachment: FirefoxCrash.html (proof of concept)

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:42.0) Gecko/20100101 Firefox/42.0
Build ID: 20151029151421

Steps to reproduce:

Open a HTML file. Click on Button "Crash Firefox".


Actual results:

Firefox crashes. Crash-Report opens up.


Expected results:

Firefox should stop the JavaScript.

Comment 1

[:Gijs (he/him)]

This reproduces on Nightly still, and crashes the content process in e10s:

https://crash-stats.mozilla.com/report/index/2fb1e30e-d9f8-4862-8a5c-aded72151229

So this is essentially:

function beep() {
  var sound = "whatever";
  sound.play();
  beep();
}

We should be showing a slow script dialog but we're not. I don't know why. I also don't know if this needs to stay sec-sensitive.

Comment 2

[Dennis Knobloch]

>I also don't know if this needs to stay sec-sensitive.
Just a precaution. My RAM fills up and I didn't checked if this could lead a serious problem.

Comment 3

[u554753]

If this is an incorrect triage, please correct as you see fit. Thanks.

Comment 4

[Anthony Jones (:ajones, :kentuckyfriedtakahe, :k17e)]

Doesn't crash but stops responding.

Louis - do your changes fix this issue?

Comment 5

[Louis Christie [:lchristie]]

(In reply to Anthony Jones (:kentuckyfriedtakahe, :k17e) from comment #4)
> Doesn't crash but stops responding.
> 
> Louis - do your changes fix this issue?

Nope, it doesn't hit any of my code, or even DecoderTraits or MediaFormatReader as far as I can see. The crash report posted above looks like it supports this too.

Comment 6

[Ralph Giles (:rillian)]

Ok, interesting. We should investigate and see whose code is spinning so hard.

Comment 7

[Randell Jesup [:jesup] (needinfo me)]

Attachment: bug1234842_jprof.html

jprof profile of letting this run for ~15 seconds.

Lots of:

[Main Thread]: D/nsMediaElement 7fcb23d04800 SuspendOrResumeElement(pause=0, suspendEvents=0) hidden=0
[Main Thread]: D/nsMediaElement 7fcb23d04800 Network state changed to NO_SOURCE
[Main Thread]: D/nsMediaElement 7fcb23d05000 SuspendOrResumeElement(pause=0, suspendEvents=0) hidden=0
[Main Thread]: D/nsMediaElement 7fcb23d05000 Network state changed to NO_SOURCE


and

[Main Thread]: D/nsMediaElement 7f76a4871800 ChangeDelayLoadStatus(1) doc=0x0
[Main Thread]: D/nsMediaElement 7f76a4871800 Network state changed to LOADING
[Main Thread]: D/nsMediaElement 7f76a4871800 Trying load from src=data:audio/wav;base64,//uQRAAAAWMSLwUIYAAsYkXgoQwAEaYLWfkWgAI0wWs/ItAAAGDgYtAgAyN+QWaAAihwMWm4G8QQRDiMcCBcH3Cc+CDv/7xA4Tvh9Rz/y8QADBwMWgQAZG/ILNAARQ4GLTcDeIIIhxGOBAuD7hOfBB3/94gcJ3w+o5/5eIAIAAAVwWgQAVQ2ORaIQwEMAJiDg95G4nQL.....

and 

[Main Thread]: D/nsMediaElement 7f76bc675000 SuspendOrResumeElement(pause=0, suspendEvents=0) hidden=0
[Main Thread]: D/nsMediaElement 7f76bc678000 Created decoder 7f76a3916120 for type audio/mpeg
[Parent 31256] WARNING: Unimplemented function NotifyDataArrived: file /home/jesup/src/mozilla/inbound_prof/dom/media/MP3Demuxer.cpp, line 89

Comment 8

[Randell Jesup [:jesup] (needinfo me)]

Note: most of the time is spent here; may be a big clue:

   2671 (43.4%) mozilla::dom::power::PowerManagerService::NewWakeLock(...)

Comment 9

[Anthony Jones (:ajones, :kentuckyfriedtakahe, :k17e)]

Eugen - is this an MP3 related issue?

Comment 10

[Eugen Sawin [:esawin]]

Attachment: Crash stack on Linux

It doesn't seem to hit any media code at all for me, it spins somewhere and eventually crashes in HTMLMediaElement::PlayInternal (when setting mPaused = false).

I've attached the reproducing crash stack I get on Linux.

Comment 11

[Anthony Jones (:ajones, :kentuckyfriedtakahe, :k17e)]

Also crashes in Chrome.

Comment 12

[Anthony Jones (:ajones, :kentuckyfriedtakahe, :k17e)]

I'm going to downgrade this to P3.

Comment 13

[Dennis Knobloch]

Crashes Firefox 50.0.1: ID 10534eb1-662e-4bb9-b5f0-1bae52161130
see https://crash-stats.mozilla.com/search/?user_comments=~1234842

Comment 14

[Thomas Nguyen (:tnguyen)]

(In reply to :Gijs from comment #1)
> This reproduces on Nightly still, and crashes the content process in e10s:
> 
> https://crash-stats.mozilla.com/report/index/2fb1e30e-d9f8-4862-8a5c-
> aded72151229
> 
> So this is essentially:
> 
> function beep() {
>   var sound = "whatever";
>   sound.play();
>   beep();
> }
> 
> We should be showing a slow script dialog but we're not. I don't know why. I
> also don't know if this needs to stay sec-sensitive.

I run FF nightly 59 and I could see the slow script appears. (testing on Mac and Ubuntu machine). Clicking on "Stop" button could stop the script. No crash for me. Dennis, could you confirm that?
Thanks

Comment 15

[Christoph Kerschbaumer [:ckerschb]]

Kevin, we are triaging evil trap bugs for Desktop at the moment. In this particular case the 'slow script' appears and you can just click stop which allows you to navigate to other tabs. In other words, it's not a DOS on Desktop. We were wondering if this bug might still be an issue for mobile. What do you think? Can we close as WORKSFORME or should we worry about mobile and keep this bug open and just mark it somehow 'evil trap on mobile' or something.

Comment 16

[Kevin Brosnan [Ex-Mozilla]]

This is a crash/DOS on a Pixel 2 XL Android 8.1

* Firefox for Android Nightly - crash, no slow script dialog
* Firefox for Android Beta - Slow script dialog, but it shows up too late for the browser to be recoverable, browser crashes
* Firefox for Android Release - Slow script dialog, no crash, browser is not usable

Comment 17

[Dennis Knobloch]

I run FF 61.0.1 (32-bit) on Windows 7: crash, no slow script dialog 

https://crash-stats.mozilla.com/search/?user_comments=~1234842&product=Firefox&date=%3E%3D2018-08-01T14%3A44%3A12.000Z&date=%3C2018-08-08T14%3A44%3A12.000Z&_sort=-date&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-signature

Comment 18

[Jim Mathies [:jimm]]

Aside from general memory use reduction work there's not much we can do here. No specific activity expected on this bug.